Please do not open public issues for security vulnerabilities.

Use one of these channels:

1. GitHub Security Advisories (preferred): Security tab in this repository.
2. If advisory access is unavailable, open an issue titled [SECURITY] Private report requested without sensitive details; maintainers will move to a private channel.

• Initial triage target: 3 business days
• Status updates during investigation
• Coordinated disclosure after fix availability